Page 1 of 7 1234 ... LastLast
Results 1 to 40 of 255
  1. #1
    Join Date
    Dec 2009
    Location
    New Zealand
    Posts
    307

    Blocking colocrossing.com IP ranges

    This outfit are a real nuisance. They visit my server repeatedly each day and I hove blocked all known IP ranges but they Still come. I don't want their visits .... its messing up my stats.

    I use IP tables / Config Server CSF.

    Where can I find ALL their IP ranges ?

  2. #2
    Join Date
    Feb 2012
    Location
    New York, NY
    Posts
    568
    Quote Originally Posted by westwing View Post
    This outfit are a real nuisance. They visit my server repeatedly each day and I hove blocked all known IP ranges but they Still come. I don't want their visits .... its messing up my stats.

    I use IP tables / Config Server CSF.

    Where can I find ALL their IP ranges ?
    http://bgp.he.net/AS36352#_prefixes

  3. #3
    Join Date
    Jun 2011
    Posts
    2,286
    What activity are you seeing from their network that's making them a nuisance?

  4. #4
    Join Date
    Dec 2009
    Location
    New Zealand
    Posts
    307
    Just constant visits .... I dont want this ...my server is none of their business

  5. #5
    Join Date
    Dec 2009
    Location
    New Zealand
    Posts
    307
    Quote Originally Posted by domainbop View Post
    Thats what I need. Thank you sir!

  6. #6
    Join Date
    Jun 2011
    Posts
    2,286
    It's probably just one of your website's regular visitors on a VPN.

    Sounds pretty crazy blocking an entire data centre from your site to me for the reason given - but I guess it's up to you how you manage your site...

    Quote Originally Posted by westwing View Post
    Just constant visits .... I dont want this ...my server is none of their business

  7. #7
    Join Date
    Dec 2009
    Location
    New Zealand
    Posts
    307
    No .... repeated login attempts to the admin area.... I appreciate its probably just one of their customers but its constant ....

  8. #8
    Join Date
    Jun 2011
    Posts
    2,286
    Have you considered moving the admin directory? A lot of the time it's automated bots that attempt to brute force logins.

  9. #9
    Join Date
    Feb 2005
    Location
    Toronto, Canada
    Posts
    5,158
    Have you tried reporting this as abuse to colocrossing?

  10. #10
    Join Date
    May 2009
    Location
    Vaduz/LI
    Posts
    2,771
    Now they even announce Iranian IPs on their own AS... seriously...

  11. #11
    Join Date
    Jan 2012
    Location
    Glasgow, Scotland
    Posts
    583

    Blocking colocrossing.com IP ranges

    Quote Originally Posted by NetDepot - Terrence View Post
    Have you tried reporting this as abuse to colocrossing?
    Getting the colocrossing abuse team to do something is like getting blood out a stone…
    HostUS - Premium Hosting Made Affordable
    EIGHT Worldwide locations spanning USA, Europe & Asia Pacific
    Own ASN, Own Network, Own IP's - AS7489 & AS25926

  12. #12
    Quote Originally Posted by HostUS - Alexander View Post
    Getting the colocrossing abuse team to do something is like getting blood out a stone…
    Not at all. We have hundreds of thousands of VPS users on our network, and we react promptly and professionally to all inquiries. You have to understand that there are sometimes 3 or 4 layers to send data to US->VPS Provider->Reseller-EndUser. It can take more than a few hours when that is the case, especially when you're managing more than a /22 worth of IPs.

  13. #13
    Well I can't see it being just random visits so it may be people using a VPN from their datacenter or something.

  14. #14
    Join Date
    Jun 2009
    Posts
    1,219
    You are not too good in managing your IP range...
    http://www.spamhaus.org/sbl/listings...ty-servers.net

    velocity-servers.net is one of your companies, isn't it?

  15. #15
    Join Date
    Dec 2009
    Location
    New Zealand
    Posts
    307
    here is the latest .... 192.3.176.188

  16. #16
    Join Date
    Feb 2012
    Location
    New York, NY
    Posts
    568
    Quote Originally Posted by westwing View Post
    here is the latest .... 192.3.176.188
    That IP is on the CleanTalk block list

    https://cleantalk.org/blacklists/AS36352

    #
    ASN, Organization name
    AS36352 ColoCrossing

    Detected IP addresses
    1,582

    Spam active IP addresses
    809

    Spam rate
    51.14%

  17. #17

  18. #18
    Join Date
    Dec 2009
    Location
    New Zealand
    Posts
    307
    No I have not ! abuse@ ?

    BTW, who wrote the "Solid Proven Results" testimonial on your front page .... read full testimonial takes you to a page without the full testimonial ....!

  19. #19

  20. #20
    Join Date
    Feb 2012
    Posts
    276
    Quote Originally Posted by domainbop View Post
    http://paste.ee/r/sJips

    Put that into list.txt

    nano blockcc.sh and paste content http://paste.ee/r/LwrDM into it.

    then sh blockcc.sh

    You'll need CSF installed by the way...

  21. #21
    Join Date
    Dec 2009
    Location
    New Zealand
    Posts
    307

  22. #22
    Join Date
    Dec 2001
    Location
    Toronto, Ontario, Canada
    Posts
    5,954
    96.8.117.143 would not be a subset of 96.8.0.0/24

    A /24 is 256 IP's, or basically the last octet. IE:, blocking 96.8.0.0/24 would block: 96.8.0.*

    If you were to block the /16, that would drop 96.8.*.* (which must be what you're thinking of), however I say this without looking into whether or not the entire /16 is colocrossing or not (IE: if you're going to block other ISP's/networks/etc. in doing so).

  23. #23
    Join Date
    Feb 2012
    Location
    New York, NY
    Posts
    568
    Try 96.8.117.128/26

    That group of IPs is assigned to Hudson Valley Host which isn't surprising since a very large percentage of the problem IPs I've had to block from CC lately have been IPs assigned to HVH.

  24. #24
    Join Date
    Dec 2009
    Location
    New Zealand
    Posts
    307
    Thanks Guys ...

  25. #25
    Join Date
    May 2008
    Location
    New York
    Posts
    742
    Quote Originally Posted by domainbop View Post
    Try 96.8.117.128/26

    That group of IPs is assigned to Hudson Valley Host which isn't surprising since a very large percentage of the problem IPs I've had to block from CC lately have been IPs assigned to HVH.
    If there is any abuse coming from an IP of ours please feel free to contact us and we will take care of it immediately. You can open a ticket with abuse here: https://billing.hudsonvalleyhost.com...tep=2&deptid=6
    Ernie - Enzu Inc.| Managed Infrastructure and Cloud Services
    Public & Private Cloud | Hybrid Cloud | Dedicated Servers | VPS | Colocation
    Los Angeles | Dallas | Chicago | Miami | Asia Optimized Network
    Amazing Reseller Program | Ernie.Quick @ enzu.com| 702-965-1615 x 7040

  26. #26
    Join Date
    Jul 2006
    Posts
    290
    Quote Originally Posted by HostUS - Alexander View Post
    Getting the colocrossing abuse team to do something is like getting blood out a stone…
    Precise my sentiments.
    Frank Coetzee
    SA Internet News Group cc


    "I hear and I forget, I see and I remember. I do and I understand. " - Chinese Proverb

  27. #27
    Join Date
    Dec 2009
    Location
    New Zealand
    Posts
    307
    I did indeed email [email protected] as suggested by JonBiloh in post 9 but I heard absolutely nothing from them at all ..... waste of time. Anyway, thanks to some help from Porcupine I have blocked them successfully thus far.

  28. #28
    Join Date
    Dec 2009
    Location
    New Zealand
    Posts
    307
    and still no reply ....

  29. #29
    Join Date
    Nov 2013
    Posts
    15
    Try these two options:
    1. Change admin directory
    2. Report it to Colocrossing team

  30. #30
    Join Date
    Jun 2009
    Posts
    428
    Quote Originally Posted by westwing View Post
    and still no reply ....
    Have you tried contacting Hudson Valley yet?

    Quote Originally Posted by HVH-Ernie View Post
    If there is any abuse coming from an IP of ours please feel free to contact us and we will take care of it immediately. You can open a ticket with abuse here: https://billing.hudsonvalleyhost.com...tep=2&deptid=6

  31. #31
    Join Date
    Dec 2010
    Posts
    94
    We blocked them long ago. Colocrossing is filled with spammers and script hacker kiddies; and it is not a recent issue. We grew tired of the spam from their network first and then noticed the script scans hitting our servers from their network. Blocked all the IP space from them we could find and never looked back.

    Contact their abuse department? HA HA HA HA HA! Like most abuser-hosting server farms they are responsive as an ill tempered stone.

  32. #32
    Join Date
    Jun 2009
    Posts
    428
    Mind posting an ip range want to add it to my block list aswell.

  33. #33

    Block Colocrossing

    Quote Originally Posted by Violent Injection View Post
    Mind posting an ip range want to add it to my block list aswell.
    I block their IP blocks in .htaccess. Constant attempts to login to admin panel.

    deny from 5.226.171.0/24
    deny from 8.17.250.0/23
    deny from 8.17.252.0/24
    deny from 23.94.0.0/22
    deny from 23.94.4.0/22
    deny from 23.94.8.0/22
    deny from 23.94.12.0/22
    deny from 23.94.16.0/20
    deny from 23.94.32.0/20
    deny from 23.94.48.0/21
    deny from 23.94.56.0/21
    deny from 23.94.56.0/22
    deny from 23.94.60.0/22
    deny from 23.94.64.0/21
    deny from 23.94.72.0/21
    deny from 23.94.72.0/22
    deny from 23.94.80.0/20
    deny from 23.94.96.0/22
    deny from 23.94.100.0/22
    deny from 23.94.104.0/23
    deny from 23.94.106.0/23
    deny from 23.94.108.0/22
    deny from 23.94.112.0/20
    deny from 23.94.128.0/20
    deny from 23.94.144.0/20
    deny from 23.94.160.0/19
    deny from 23.94.192.0/20
    deny from 23.94.208.0/20
    deny from 23.94.224.0/20
    deny from 23.94.240.0/21
    deny from 23.94.248.0/21
    deny from 23.95.0.0/16
    deny from 23.229.96.0/20
    deny from 23.229.112.0/20
    deny from 23.236.240.0/20
    deny from 23.249.160.0/21
    deny from 23.249.168.0/23
    deny from 23.249.170.0/24
    deny from 23.249.172.0/23
    deny from 23.250.112.0/20
    deny from 23.254.88.0/21
    deny from 23.254.96.0/20
    deny from 23.254.112.0/20
    deny from 65.99.193.0/24
    deny from 65.99.246.0/24
    deny from 66.225.194.0/23
    deny from 66.225.198.0/24
    deny from 66.225.231.0/24
    deny from 66.225.232.0/24
    deny from 69.31.134.0/24
    deny from 72.249.94.0/24
    deny from 72.249.124.0/24
    deny from 75.102.10.0/24
    deny from 75.102.27.0/24
    deny from 75.102.34.0/24
    deny from 75.102.38.0/23
    deny from 75.127.0.0/24
    deny from 75.127.1.0/24
    deny from 75.127.2.0/23
    deny from 75.127.4.0/24
    deny from 75.127.5.0/24
    deny from 75.127.6.0/23
    deny from 75.127.8.0/23
    deny from 75.127.10.0/23
    deny from 75.127.12.0/23
    deny from 75.127.14.0/23
    deny from 96.8.112.0/23
    deny from 96.8.114.0/23
    deny from 96.8.116.0/24
    deny from 96.8.117.0/24
    deny from 96.8.118.0/24
    deny from 96.8.119.0/24
    deny from 96.8.120.0/24
    deny from 96.8.121.0/24
    deny from 96.8.122.0/24
    deny from 96.8.123.0/24
    deny from 96.8.124.0/24
    deny from 96.8.125.0/24
    deny from 96.8.126.0/23
    deny from 107.161.144.0/21
    deny from 107.161.152.0/24
    deny from 107.161.155.0/24
    deny from 107.161.156.0/23
    deny from 107.161.158.0/24
    deny from 107.172.0.0/20
    deny from 107.172.16.0/23
    deny from 107.172.64.0/20
    deny from 107.172.96.0/20
    deny from 107.172.128.0/20
    deny from 107.172.192.0/20
    deny from 107.173.16.0/20
    deny from 107.173.64.0/20
    deny from 107.173.80.0/20
    deny from 107.173.144.0/20
    deny from 107.173.192.0/20
    deny from 108.174.48.0/21
    deny from 108.174.56.0/22
    deny from 108.174.60.0/24
    deny from 108.174.61.0/24
    deny from 108.174.62.0/23
    deny from 162.218.88.0/23
    deny from 162.218.90.0/23
    deny from 162.218.92.0/23
    deny from 162.218.94.0/24
    deny from 162.221.176.0/23
    deny from 162.221.178.0/23
    deny from 162.221.180.0/23
    deny from 162.221.182.0/24
    deny from 162.221.183.0/24
    deny from 172.245.0.0/20
    deny from 172.245.16.0/22
    deny from 172.245.20.0/22
    deny from 172.245.24.0/21
    deny from 172.245.32.0/21
    deny from 172.245.40.0/22
    deny from 172.245.44.0/22
    deny from 172.245.56.0/21
    deny from 172.245.64.0/19
    deny from 172.245.96.0/21
    deny from 172.245.104.0/21
    deny from 172.245.112.0/20
    deny from 172.245.128.0/19
    deny from 172.245.176.0/21
    deny from 172.245.208.0/21
    deny from 172.245.216.0/22
    deny from 172.245.220.0/22
    deny from 172.245.224.0/20
    deny from 172.245.240.0/20
    deny from 192.3.0.0/20
    deny from 192.3.16.0/22
    deny from 192.3.20.0/22
    deny from 192.3.24.0/23
    deny from 192.3.26.0/23
    deny from 192.3.28.0/22
    deny from 192.3.32.0/21
    deny from 192.3.40.0/21
    deny from 192.3.48.0/22
    deny from 192.3.52.0/22
    deny from 192.3.56.0/22
    deny from 192.3.60.0/22
    deny from 192.3.80.0/21
    deny from 192.3.88.0/22
    deny from 192.3.92.0/22
    deny from 192.3.96.0/21
    deny from 192.3.104.0/22
    deny from 192.3.108.0/22
    deny from 192.3.112.0/21
    deny from 192.3.120.0/21
    deny from 192.3.128.0/21
    deny from 192.3.136.0/21
    deny from 192.3.144.0/21
    deny from 192.3.152.0/22
    deny from 192.3.156.0/22
    deny from 192.3.160.0/22
    deny from 192.3.164.0/23
    deny from 192.3.166.0/23
    deny from 192.3.168.0/21
    deny from 192.3.176.0/20
    deny from 192.3.192.0/20
    deny from 192.3.208.0/20
    deny from 192.3.224.0/19
    deny from 192.210.128.0/21
    deny from 192.210.136.0/22
    deny from 192.210.140.0/23
    deny from 192.210.142.0/23
    deny from 192.210.144.0/22
    deny from 192.210.148.0/23
    deny from 192.210.150.0/23
    deny from 192.210.160.0/19
    deny from 192.210.192.0/22
    deny from 192.210.196.0/22
    deny from 192.210.200.0/22
    deny from 192.210.204.0/22
    deny from 192.210.208.0/23
    deny from 192.210.210.0/24
    deny from 192.210.211.0/24
    deny from 192.210.212.0/23
    deny from 192.210.214.0/24
    deny from 192.210.215.0/24
    deny from 192.210.216.0/22
    deny from 192.210.220.0/22
    deny from 192.210.226.0/24
    deny from 192.210.227.0/24
    deny from 192.210.228.0/22
    deny from 192.210.232.0/22
    deny from 192.210.236.0/22
    deny from 192.210.240.0/20
    deny from 192.227.128.0/21
    deny from 192.227.136.0/22
    deny from 192.227.140.0/22
    deny from 192.227.160.0/22
    deny from 192.227.164.0/22
    deny from 192.227.168.0/21
    deny from 192.227.176.0/20
    deny from 192.227.180.0/24
    deny from 192.227.192.0/20
    deny from 192.227.208.0/20
    deny from 192.227.224.0/21
    deny from 192.227.232.0/22
    deny from 192.227.236.0/22
    deny from 192.227.240.0/21
    deny from 192.227.248.0/22
    deny from 192.227.252.0/22
    deny from 198.12.64.0/22
    deny from 198.12.68.0/23
    deny from 198.12.70.0/23
    deny from 198.12.72.0/22
    deny from 198.12.76.0/22
    deny from 198.12.80.0/21
    deny from 198.12.88.0/21
    deny from 198.12.96.0/20
    deny from 198.12.112.0/22
    deny from 198.12.116.0/22
    deny from 198.12.120.0/23
    deny from 198.12.122.0/24
    deny from 198.12.123.0/24
    deny from 198.12.124.0/22
    deny from 198.23.128.0/22
    deny from 198.23.132.0/22
    deny from 198.23.136.0/21
    deny from 198.23.144.0/22
    deny from 198.23.148.0/24
    deny from 198.23.149.0/24
    deny from 198.23.150.0/23
    deny from 198.23.152.0/22
    deny from 198.23.156.0/22
    deny from 198.23.160.0/23
    deny from 198.23.164.0/23
    deny from 198.23.166.0/23
    deny from 198.23.168.0/21
    deny from 198.23.168.0/22
    deny from 198.23.172.0/22
    deny from 198.23.176.0/20
    deny from 198.23.192.0/20
    deny from 198.23.208.0/20
    deny from 198.23.224.0/23
    deny from 198.23.226.0/23
    deny from 198.23.228.0/22
    deny from 198.23.232.0/21
    deny from 198.23.240.0/22
    deny from 198.23.244.0/22
    deny from 198.23.248.0/23
    deny from 198.23.250.0/23
    deny from 198.23.252.0/24
    deny from 198.23.253.0/24
    deny from 198.23.254.0/23
    deny from 198.46.128.0/21
    deny from 198.46.136.0/22
    deny from 198.46.140.0/22
    deny from 198.46.144.0/22
    deny from 198.46.148.0/22
    deny from 198.46.152.0/23
    deny from 198.46.154.0/23
    deny from 198.46.156.0/22
    deny from 198.46.160.0/19
    deny from 198.46.192.0/19
    deny from 198.46.224.0/19
    deny from 198.144.176.0/21
    deny from 198.144.184.0/22
    deny from 198.144.188.0/22
    deny from 198.206.8.0/21
    deny from 199.21.112.0/24
    deny from 199.21.113.0/24
    deny from 199.21.114.0/24
    deny from 199.21.115.0/24
    deny from 199.188.100.0/23
    deny from 199.188.102.0/24
    deny from 199.188.103.0/24
    deny from 204.86.16.0/20
    deny from 205.234.152.0/24
    deny from 205.234.153.0/24
    deny from 205.234.159.0/24
    deny from 205.234.203.0/24
    deny from 206.123.95.0/24
    deny from 206.217.128.0/23
    deny from 206.217.130.0/24
    deny from 206.217.131.0/24
    deny from 206.217.132.0/23
    deny from 206.217.134.0/23
    deny from 206.217.136.0/23
    deny from 206.217.138.0/24
    deny from 206.217.139.0/24
    deny from 206.217.140.0/23
    deny from 206.217.142.0/24
    deny from 206.217.143.0/24
    deny from 207.210.239.0/24
    deny from 207.210.254.0/24
    deny from 216.246.49.0/24
    deny from 216.246.108.0/24
    deny from 216.246.109.0/24

  34. #34
    Join Date
    Nov 2006
    Posts
    648
    Interesting, I just added this for a quick test to a shared cPanel server via iptables, load dropped by over 50% instantly.
    Twikam
    UK cPanel hosting • Super fast UK shared hosting with IP's and SSL
    UK VPS Hosting High Bandwidth VPS Servers

  35. #35
    Join Date
    Mar 2007
    Location
    USA
    Posts
    4,904
    While stopping spam and abuse is important, it shouldn't be that big a deal where you're blocking entire providers proactively. Building up an extremely large firewall has issues of its own.

    You say it's 'messing up your stats'; Then, that might be a better place to solve the problem. Depending on your application, it may not be necessary to track visitors for your backend using traditional analytics. Server logs should do fine for review.

    If you're worried about security, then you're not confident in the application your running. Proper access control, and login failure tracking should do the trick.

    Those are just two examples that may or may not fit your exact case. However, I've far too often seen people go directly to blocking by IP address when more sane solutions are available. Of course, there are definitely instances when being brute forced on a web page over port 80 or 443 where blocking the IP is the best solution. However, you can also consider using a whitelist rather than a blacklist.

  36. #36
    Join Date
    Dec 2009
    Location
    New Zealand
    Posts
    307
    Well I blocked their IP ranges months ago abd have seen no activity since so I say good riddance to Colocrossing. They never replied to my abuse@ email either....cowboys!

  37. #37
    Join Date
    May 2008
    Posts
    660
    I had the same issue aswell. using ipb vbulletin i had 300 ips only from colocrossing trying to login to my admin panel and aswell having members complaining that their receieved email that someone is trying to change your password
    the block list is really handy so thanks .

  38. #38
    Join Date
    Dec 2001
    Location
    Toronto, Ontario, Canada
    Posts
    5,954
    Has anybody else noticed a similar pattern with "scalabledns.com"'s IP space?

    We've been getting relentless abuse from several netblocks under this brand ("Enzu" appears to be the company that owns 'em, and it looks like they do VPS's at a glance).

  39. #39
    Join Date
    Nov 2007
    Location
    the hot aisle
    Posts
    557
    Quote Originally Posted by porcupine View Post
    Has anybody else noticed a similar pattern with "scalabledns.com"'s IP space?

    We've been getting relentless abuse from several netblocks under this brand ("Enzu" appears to be the company that owns 'em, and it looks like they do VPS's at a glance).
    I'll PM you to help you out with that.
    BudgetVM - The Virtualization Experts
    Mike Gazzerro, Account Manager
    Chicago, Miami, Dallas, Los Angeles
    Wholly owned by Enzu Inc., an Inc500 Company.

  40. #40
    Do you have specific IP addresses that querying your servers? It is unlikely that all IPs from colocrossing should be blacklisted here.

Page 1 of 7 1234 ... LastLast

Similar Threads

  1. Blocking ip ranges from certian countrys
    By mrgeekchris in forum Fraud and Abuse
    Replies: 2
    Last Post: 01-07-2012, 06:34 PM
  2. LiquidWeb blocking IP ranges?
    By Esau in forum Providers and Network Outages and Updates
    Replies: 0
    Last Post: 12-15-2009, 03:00 PM
  3. Is blocking email from dynamic IP ranges a good idea?
    By ewhost in forum Dedicated Server
    Replies: 0
    Last Post: 11-08-2006, 10:35 PM
  4. Blocking Fraud-Likely IP Ranges
    By Dan Grossman in forum Ecommerce Hosting & Discussion
    Replies: 5
    Last Post: 08-30-2004, 11:56 PM
  5. Blocking IP ranges from countries, help required
    By silock in forum Other Offers & Requests
    Replies: 0
    Last Post: 08-15-2004, 09:15 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •